Hi Team, Thanks in advance, Need a quick help in Regex query, Input values:  KUL6LJBJ62YD BLR6LC7BLNJR HRI6M5G6KKPH KUL6LJ3N0F6J HRI6LBJKRHHR HRI6LB65G6NF   Expected output:  First 3 character of each phrase.   CUrrent Regex : (?<SITE_NAME>[^\W]{3})    << BUT AM not getting proper output>> Expected Output : | table SITE_NAME KUL BLR HRI KUL HRI HRI   Thanks Jerin V ... View more

Hi Team, I need a help in preparing a availability calculator.   Below graph is the requirement. Current output form code below:  DESCRIPTION downtime Time QIT-LAG 00:00:06 2022-07-31 QIT-LAG 00:00:09 2022-07-29 QIT-LAG 00:00:08 2022-07-29 QIT-LAG 00:00:10 2022-07-29   Current manual action:  1. Am extracting above table in excel, 2. converting all duration to seconds 3. grouing it with Day wise. 4. preparing a percentage loss out of 86400 (24*60*60) on each day is the graph. CODE:      index=opennms | search DESCRIPTION="QIT-LAG" | transaction nodelabel startswith=eval(Status="DOWN") endswith=eval(Status="UP") keepevicted=true | eval downtime=if(closed_txn=1,duration,null) | eval downtime=tostring(downtime, "duration") | fillnull value="" downtime | eval Status=if(closed_txn=1,"UP","DOWN") | rex field=downtime "(?P<downtime>[^.]+)" | rename _time as Time | fieldformat Time=strftime(Time,"%Y-%m-%d") | table DESCRIPTION, downtime, Time,       Challenge:  how to convert the current downtime into seconds and also add it with day basis and prpeare a percentage basis graph. Thanks In advance for guidance and help.        ... View more

Hi All, I have a code, that uses the output to fetch data from another Panel. First Panel   <title>Juniper Mnemonics</title> <table> <search> <query>index=nw_syslog | search hostname="*DCN*" | stats count by cisco_mnemonic, hostname | sort - count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <condition field="cisco_mnemonic"> <set token="message_token">$click.value$</set> </condition> <condition field="hostname"> <set token="hostname_token">$click.value$</set> </condition> <condition field="count"></condition> </drilldown> </table>     From this panel 2 contents are fetched for second panel search. Second Panel   index=nw_syslog | search hostname="*DCN*" | search cisco_mnemonic="$message_token$" | search hostname="$hostname_token$" | stats count by message | sort - count     Issue:  When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly. Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.     ... View more

Hi All, Need help in getting the right rex filter for the below _raw data.   2021-12-04T01:29:48.015524+00:00 USHCO-EXXON, ipsec-ike-down, 689, "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-tunnel-down, 687, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-ike-down, 686, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-tunnel-down, 872, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-ike-down, 871, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB     Above is the raw data.   Requirement :  All the content within " " need to filtered. Example     "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"     Above content to be filtered into Event_Log   | rex field=_raw "(?<Event_Log>[^"]+)"   But something am missing, its not capturing the data ... View more

Hi All, I want a small addition to the output values. Code am using :    | inputlookup ONMS_nodes.csv | table nodelabel | join type=outer nodelabel [ search index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel Status ] | table nodelabel Status     Output table :  nodelabel Status INBLR-LANCCO001 Up INBLR-LANCUA002 Up INBLR-LANCUA004 Up INBLR-LANCUA006 Up INBLR-LANCUA007   INBLR-LANCUA008 Up INBLR-WANRTC001 Up INBLR-WANRTC002 Up INBLR-WANRTC003     Reason some device not having status is, SNMP polling didnt happened for that device. I want a simplified output as expected below. Additional line of code:    | eval Device= nodelabel." [".Status."]"     Device INBLR-LANCCO001 [Up] INBLR-LANCUA002 [Up] INBLR-LANCUA004 [Up] INBLR-LANCUA006 [Up]   INBLR-LANCUA008 [Up] INBLR-WANRTC001 [Up] INBLR-WANRTC002 [Up]     Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked.  please help me with it. ... View more

Hi All, I have a code, that gives below output. CODE:  | inputlookup ONMS_nodes.csv | table nodelabel OUTPUT :  nodelabel LANCUA005 LANCUA008 LANCUA012 LANCUA014 LANCUA016 LANCUA018 LANCUA019 LANCUA020 LANCUA022 LANCUA023   This is a sample output. List can goes more than 600 or 700 devices.  Requirement is like :  Can we split this into multiple columns within the panel. nodelabel nodelabel LANCUA005 LANCUA016 LANCUA008 LANCUA018 LANCUA012 LANCUA019 LANCUA014 LANCUA020 LANCUA023 LANCUA022   SO that the content can be used the whole single panel  page to display the entire content. ... View more

Hi All, I am having challenge to filter the highest value and prepare a new column. Code:    index=nw_ppm | table "From Device", "To Device", "Latency", "Time (UTC/GMT)" | search Latency!=0 | eval Latency = round(Latency, 2) | rename "Time (UTC/GMT)" as Time | xyseries Time "From Device" "Latency"     Table am getting: Time IPSLA1 IPSLA2 IPSLA3 10:13:00   38  10.1 10:14:00 77.77     10:23:00 77  35  9.89 10:34:00 78.35     10:37:00     10.76 10:43:00 78 36.29 10.61 11:13:00 79     11:14:00 72.82     11:23:00   36.33   11:24:00 73.02     11:33:00   37.67   Requirement :  I want the highest value to be  populated on to a last new Colum. Expected output table:  Time IPSLA1 IPSLA2 IPSLA3 Highest 10:13:00   38  10.1 38 10:14:00 77.77     77.77 10:23:00 77  35  9.89 77 10:34:00 78.35     78.35 10:37:00     10.76 10.76 10:43:00 78 36.29 10.61 78 11:13:00 79     79 11:14:00 72.82     72.82 11:23:00   36.33   36.33 11:24:00 73.02     73.02 11:33:00   37.67   37.67   Also the "From Device" list is :    index=nw_ppm | table "From Device"   From Device IPSLA1 IPSLA2 IPSLA3 ... View more

Hi All, Need help in a Splunk code. Below is the data am having and a sample Table how the output looks like. Input data:  From To Latency CATRC CACCO 43.94 CATRC CATRC 0 CATRC GBLCO 148.61 CATRC GBLHD 88.06 CATRC INMCO 283.96 CATRC CACCO 43.94 CATRC CATRC 0 CATRC GBLCO 148.61 CATRC GBLHD 88.06 CATRC INMCO 283.96   Required Output Table:    CACCO CATRC GBLCO GBLHD INMCO CACCO 0 43.94 167.54 131.97 305.64 CATRC 44.61 0 148.61 88.06 283.96 GBLCO 167.54 148.61 0 3.51 137.96 GBLHD 131.97 88.06 3.51 0 5.5 INMCO 305.64 283.96 137.96 5.5 0   Challenge in getting Code for both X and Y axis in the table. ... View more

Hi All, need help in using 2 stats operation in one program. My program:   index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel,Status,Time | lookup ONMS_nodes.csv nodelabel OUTPUT sitecode | table nodelabel,Status,Time, sitecode   Output Table :  nodelabel Status Time sitecode AOKWA1 Down 1/20/2021 20:36 KWA BXTPR Down 1/20/2021 20:34 TPR UKHCO Down 1/20/2021 20:32 HCO AOKWA3 Down 1/20/2021 20:30 KWA AOKWA2 Down 1/20/2021 20:29 KWA AOKWA4 Down 1/20/2021 20:18 KWA   Here I have KWA 4 times. Requirement : i need to filter only those sitescodes which are greater than 3 numbers.( all KWA only should be listed in my required output table, ignore all with sitecode count less than 3)   ... View more

Hi all, Need your help in splitting the panels into 2 halfs. ataching 2 pitcures.  1. first one is the current panel structure am using. Current Panel design 2. second once is what we are looking for. Expected Panel design ... View more

Hi All, Need help in the Duration filter. Code:    index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify" | rex field=eventuei "ciscoLwappApIf(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | where Status="DownNotify" | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S") | eval Downtime = now() - Time | eval Downtime = tostring(Downtime, "duration") | rex field=Downtime "(?P<Downtime>[^.]+)" | table nodelabel, Status, Downtime, Time     Sample output:  nodelabel Status Downtime Time USBTNBTECE DownNotify 0:12:02 12/9/2020 2:36 USJOLWLC DownNotify 1:31:21 12/9/2020 2:17 USMBP DownNotify 2:08:25 12/9/2020 1:39   Requirement is.:  Filter/remove all those values less than 1 hr Downtime. Tried all possibilities  "| where duration >3600"  but no output coming when giving this. Please suggest a solution.  ... View more